CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers
Description
An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.
- Likelihood of attack
- Medium
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- Awareness of the hardware being leveraged.
- Access to the hardware being leveraged.
Skills required
- MediumAbility to execute actions within the SoC.
- HighIntricate knowledge of the identifiers being utilized.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Review generation of security identifiers for design inconsistencies and common weaknesses.
- Review security identifier decoders for design inconsistencies and common weaknesses.
- Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.